vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| 0x676e67 |
|
No data.
No data.
References
History
Thu, 31 Jul 2025 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
0x676e67
0x676e67 vproxy |
|
| Vendors & Products |
0x676e67
0x676e67 vproxy |
Wed, 30 Jul 2025 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 30 Jul 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0. | |
| Title | vproxy is vulnerable to a divide by zero DoS attack | |
| Weaknesses | CWE-369 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-07-30T20:23:36.826Z
Reserved: 2025-07-25T16:19:16.093Z
Link: CVE-2025-54581
Vulnrichment
Updated: 2025-07-30T20:14:08.155Z
NVD
Status : Awaiting Analysis
Published: 2025-07-30T20:15:37.907
Modified: 2025-07-31T18:42:37.870
Link: CVE-2025-54581
Redhat
No data.